Sunteți pe pagina 1din 27

WS 2008 R2 Active Directory:

Diving in to the core

Siddharth Bhai

Program Manager, Microsoft Corp

Presented at the Windows Networking User Group on Feb 3, 2010.

Agenda

Windows Server 2008 R2

AD Recycle bin

Offline Domain Join

AD Technologies

QnA

Windows Server 2008 R2

Windows Server 2008 R2 Active Directory™ Comprehensive PowerShell commands • to manage ADDS and ADLDS Task

Active Directory™

Comprehensive

PowerShell

commands

• to manage ADDS and ADLDS
• to manage ADDS and
ADLDS

Task based management UI

• simplifies IT Pro workflows
• simplifies IT Pro workflows

AD Recycle Bin

• saves AD objects and jobs from accidental deletion
• saves AD objects and jobs
from accidental deletion

Offline Domain Join

• streamlines data center deployments
• streamlines data center
deployments

Managed-Service

Accounts

• reduces service management costs
• reduces service
management costs

Authentication

assurance

• enables enforcement of federation policies
• enables enforcement of
federation policies

Our focus Today

Our focus Today Active Directory™ Comprehensive PowerShell commands • to manage ADDS and ADLDS Task based

Active Directory™

Comprehensive

PowerShell

commands

• to manage ADDS and ADLDS
• to manage ADDS and
ADLDS

Task based management UI

• simplifies IT Pro workflows
• simplifies IT Pro workflows
• saves AD objects and jobs AD Recycle Bin from accidental deletion
• saves AD objects and jobs
AD Recycle Bin
from accidental deletion
Offline Domain Join • streamlines data center deployments
Offline Domain
Join
• streamlines data center
deployments

Managed-Service

Accounts

• reduces service management costs
• reduces service
management costs

Authentication

assurance

• enables enforcement of federation policies
• enables enforcement of
federation policies

AD Recycle Bin

• What is it?
• What is it?

allows recovery of any deleted Active Directory object in its complete & original condition

• What do you need to know?
• What do you need to know?

you are able to fully recover deleted-objects

there is a configurable interval for the duration in which a deleted

object can be recovered

• How do you prep to use it?
• How do you prep to use it?

requires forest-functional level 4 (WIN2008R2)

You must manually enable the feature

Recycle Bin Object Lifecycle

Windows Server 2008 - no Recycle Bin feature Live Tombstone Garbage Windows Server 2008 Object
Windows Server 2008
- no Recycle Bin feature
Live
Tombstone
Garbage
Windows Server 2008
Object
Object
Collection
- with Recycle Bin enabled
Live
Garbage
Deleted
Recycled
Object
Collection
Object
Object

Recycle Bin Object Lifecycle

180 Days
180 Days
Windows Server 2008
Windows Server 2008
Bin – Object Lifecycle 180 Days Windows Server 2008 Live Object Tombstone Object Garbage collection Returns
Live Object Tombstone Object Garbage collection
Live Object
Tombstone Object
Garbage collection
Returns Tombstones LDAP OID 1.2.840.113556.1.4.417 Returns Deleted LDAP OID 1.2.840.113556.1.4.2064 Windows Server
Returns Tombstones
LDAP OID 1.2.840.113556.1.4.417
Returns Deleted
LDAP OID 1.2.840.113556.1.4.2064
Windows Server 2008 R2
Returns Deleted and Recycled
- with Recycle Bin enabled
R2 Returns Deleted and Recycled - with Recycle Bin enabled Live Object Deleted Object Recycled Object
Live Object Deleted Object Recycled Object Garbage collection
Live Object
Deleted Object
Recycled Object
Garbage collection
Recycled - with Recycle Bin enabled Live Object Deleted Object Recycled Object Garbage collection 180 Days
180 Days
180 Days
180 Days
180 Days
Recycled - with Recycle Bin enabled Live Object Deleted Object Recycled Object Garbage collection 180 Days
Recycled - with Recycle Bin enabled Live Object Deleted Object Recycled Object Garbage collection 180 Days

Recycle Bin details

• What was the configurable interval you told us about?
• What was the configurable interval you told us about?

Deleted Object Lifetime (DOL) = TombStone Lifetime (TSL) = 180 days (by default) AD admins : Changes in notion of TSL (Deleted Object Lifetime or DOL)

–
in notion of TSL (Deleted Object Lifetime or DOL) – – – both can be modified

both can be modified independently (cn=Directory Services,cn=Windows NT, cn=Services, cn=Config…)

msDS-deletedObjectLifetime

tombstoneLifetime

• What does this mean for my backups?
• What does this mean for my backups?

backups remain valid for the lesser of DOL, TSL

• Restore an object < Get-ADObject -Filter {displayName -eq "Mary"} -IncludeDeletedObjects |
• Restore an object
<
Get-ADObject -Filter {displayName -eq "Mary"} -IncludeDeletedObjects | Restore-ADObject
•
-IncludeDeletedObjects | Restore-ADObject • Demand-deletion – aka. instant-recycle (double-delete)
-IncludeDeletedObjects | Restore-ADObject • Demand-deletion – aka. instant-recycle (double-delete)

Demand-deletion aka. instant-recycle (double-delete)

delete the object from the Deleted Objects container

Get-ADObject –Filter {<suitable filter>} –IncludeDeletedObjects | Remove-ADObject
Get-ADObject –Filter {<suitable filter>} –IncludeDeletedObjects | Remove-ADObject

Deleted Object Lifetime

DeletedObjectLifetime

Is the period during which a deleted object can be restored, fully without loss of attributes

Not set by default

If DOL = null, a deleted object stays deleted for tombstoneLifetime

(fallback)

Recycled Object Lifetime

tombstoneLifetime is the actual attribute (default = 180 days)

User should not worry about this as it is simply an artifact of replication

Too short lingering objects; too long database bloat

Recycle Bin impact to your AD deployment

• Impact on the DIT
• Impact on the DIT

the first Windows Server 2008 R2 DC generates churn, why?

DIT-size on existing downlevel DCs initially remains (mostly) unaffected

replicated isRecycled property represents a trivial increase in size

DIT-size on Windows Server 2008 R2 DC instantly ~10-15% larger than non-R2 DCs

due to additional columns and indices that are present from day-one

once Recycle Bin is turned on, expect 10-15% plus ongoing impact of new deletions

• Feature NOT enabled by functional level alone
• Feature NOT enabled by functional level alone

our first (and currently only) optional feature

optional features need to be switched on / bound to schema FSMO

Enable-ADOptionalFeature ‘Recycle Bin Feature’ –Scope ForestOrConfigurationSet –Target {target DC or LDS-instance
Enable-ADOptionalFeature ‘Recycle Bin Feature’ –Scope ForestOrConfigurationSet
–Target {target DC or LDS-instance DN}
• Resulting behavioral changes

once object isRecycled, traditional tombstone reanimation blocked

Windows 7 Optional Features

CN=Optional Features, CN=Directory Service, CN=Windows NT, CN=Services, CN=Configuration, DC=contoso,DC=com
CN=Optional Features,
CN=Directory Service,
CN=Windows NT,
CN=Services,
CN=Configuration,
DC=contoso,DC=com
CN=Partitions,
CN=Configuration,
DC=contoso,DC=com

Recycle Bin recovering objects

Delete
Delete
• Deleted Objects container
Deleted Objects container

flat list of objects in deleted state

RDN mangled (<RDN>+DEL:+CHAR(0A))

linked/non-linked attributes preserved

– linked/non-linked attributes preserved • lastKnownParent and lastKnownRDN populated •

lastKnownParent and lastKnownRDN populated

• Restore objects to live parent
• Restore objects to live parent

deleted objects MUST be restored to a live parent

perform restore top-down

\0ADEL:…
\0ADEL:…
\0ADEL:…
\0ADEL:…
\0ADEL:…
\0ADEL:…

lastKnownXX properties useful in rebuilding hierarchy

\0ADEL:…
\0ADEL:…
\0ADEL:
\0ADEL:

Deleting an Object

Object deletion in WS08: Object deletion in WS08 R2: isDeleted=TRUE isDeleted=TRUE; isRecycled=NULL lastKnownParent
Object deletion in WS08:
Object deletion in WS08 R2:
isDeleted=TRUE
isDeleted=TRUE; isRecycled=NULL
lastKnownParent set
lastKnownParent, ms-DS-lastKnownRDN set
Moved to the DeletedObjects container
Moved to the DeletedObjects container
DN is mangled
•rDN beyond 128 char would be
DN is mangled
•rDN beyond 128 char would be
truncated
truncated
•Hierarchy is effectively flattened
•Hierarchy is effectively flattened
All but a few non-linked attributes (e.g. GUID,
SID, sidHistory, etc.) are preserved
All non-linked attributes are preserved
All linked attributes (e.g. member/memberOf)
are stripped away
All linked attributes are preserved
Only visible with ShowDeletedObjects LDAP
control
Only visible with ShowDeletedObjects LDAP
control
Purged after tombstoneLifetime expires
Purged after deletedObjectLifetime expires if
that value is set, else after tombstoneLifetime
expires

Restoring an Object

Object restoration in WS08: Object restoration in WS08 R2: Delete isDeleted attribute Delete isDeleted attribute
Object restoration in WS08:
Object restoration in WS08 R2:
Delete isDeleted attribute
Delete isDeleted attribute
Change DN based on
lastKnownParent and mangled DN
Change DN based on
lastKnownParent and ms-DS-
lastKnownRDN
Only some non-linked attributes (e.g.
GUID, SID, sidHistory, etc.) are
restored  import old values from
snapshots
All non-linked attributes are restored
None of the linked attributes (e.g.
member/memberOf) are restored 
regenerate links using LDIFs from
All linked attributes, even cross-
domain links, are restored
auth restore
Tool: ldp.exe
Tool: ldp.exe, Active Directory
PowerShell

How an Object is Deleted

In WS08:

Object is first locally deleted

Non-linked attributes that are not preserved are cleared (in the data table)

All linked attributes are removed (from the link table)

Object deletion is replicated

isDeleted=TRUE is the replicated event

Same operations as above are repeated on each notified DC

Cross-domain DCs are notified as follows:

Infrastructure Master checks Global Catalog server for referenced objects with mangled DN (indicating object deletion)

If so, creates an InfrastructureUpdateObject to trigger deletions of object

on various DCs

How an Object is Deleted

In WS08 R2:

Object is first locally deleted

All non-linked attributes are preserved (in the data table)

All linked attributes (in the link table) are marked as deactivated

Object deletion is replicated

isDeleted=TRUE is the replicated event

Same operations as above are repeated on each notified DC

Cross-domain DCs are notified as follows:

Every DC checks Global Catalog server for referenced objects with mangled DN (indicating object deletion)

If so, deletes object locally

AD LDS has Recycle Bin too!

Ensure all instances in the configuration set

are running Windows Server 2008 R2

Use LDIFDE to extend schema using MS- ADAM-Upgrade-2.LDF shipped inbox

Restoring Object(s) - ADPsh

Restoring Object(s) - ADPsh • #Restore a single object • Get-ADObject -Filter {displayName -eq "Mary"} -

#Restore a single object

• Get-ADObject -Filter {displayName -eq "Mary"} - IncludeDeletedObjects | Restore-ADObject
• Get-ADObject -Filter {displayName -eq "Mary"} -
IncludeDeletedObjects | Restore-ADObject

#Restore a tree

• Get-ADObject -ldapFilter:"(msDS- LastKnownRDN=Finance_Department)" –IncludeDeletedObjects |
• Get-ADObject -ldapFilter:"(msDS-
LastKnownRDN=Finance_Department)" –IncludeDeletedObjects |
Restore-ADObject
• Get-ADObject -SearchBase "CN=Deleted
Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq
"OU=Finance_Department,DC=contoso,DC=com"} -
IncludeDeletedObjects | Restore-ADObject
• Get-ADObject -SearchBase "CN=Deleted
Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq
"OU=Admins,OU=Finance_Department,DC=contoso,DC=com"} -
IncludeDeletedObjects | Restore-ADObject

Setting object lifetimes - ADPsh

#Change deletedObjectLifetime

Set-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=mydomain,DC=com”
Set-ADObject -Identity “CN=Directory Service,CN=Windows
NT,CN=Services,CN=Configuration,DC=mydomain,DC=com” –Partition
“CN=Configuration,DC=mydomain,DC=com” –Replace:@{“msDS-DeletedObjectLifetime” = 60}

#Change tombstoneLifetime

Set-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=mydomain,DC=com”
Set-ADObject -Identity “CN=Directory Service,CN=Windows
NT,CN=Services,CN=Configuration,DC=mydomain,DC=com” –Partition
“CN=Configuration,DC=mydomain,DC=com” –Replace:@{“tombstoneLifetime” = 365}

Offline Domain Join (ODJ)

• What does it do?
• What does it do?

allows a client to fully achieve a domain-joined state without ever having communicated with a domain controller

• What do you need to know?
• What do you need to know?

machines are domain-joined on initial boot without requirement for network connectivity
reduces reboots / time needed to deploy OS images

• How do you prep for it?
• How do you prep for it?

NO forest or domain functional level requirement

NO Windows Server 2008 R2 DCs required

joining machine must, however, be Windows 7 client or Windows

Server 2008 R2 member

ODJ try it yourself

1.

2.

3.

4.

5.

Get a new Windows 7 client or Windows Server 2008 R2 machine

Gracefully shut down the new machine

Gain writeable access to the new machine’s physical or virtual disk

On a second domain-joined machine & using domain-join-capable

credentials, run

djoin /provision /domain <target domain> /machine <new machine name> /savefile <filename> djoin
djoin /provision /domain <target domain>
/machine <new machine name> /savefile <filename>
djoin /requestODJ /loadfile <filename>
/windowspath <path to new machine’s %windir%>

Reboot new machine – it’s now in a fully domain-joined state

ODJ specifics on the “blob”

ODJ – specifics on the “blob”
ODJ – specifics on the “blob”
ODJ – specifics on the “blob”

Offline Join: Developer Support

NET_API_STATUS NetProvisionComputerAccount(

in

LPCWSTR lpDomain,

in

LPCWSTR lpMachineName,

in_opt

LPCWSTR lpMachineAccountOU,

in_opt

LPCWSTR lpDcName,

in

DWORD dwOptions,

out_opt

PBYTE pProvisionBinData,

out_opt

DWORD pdwProvisionBinDataSize,

out_opt

LPWSTR pProvisionTextData

);

NET_API_STATUS NetRequestOfflineDomainJoin(

in

BYTE

*pProvisionBinData,

in

DWORD

cbProvisionBinDataSize,

in

DWORD

dwOptions,

in

LPCWSTR

lpWindowsPath

);

Offline Join: The Possibilities

Rapid deployments in next-gen datacenters

Goal: Deploy 1000 new servers every 30 minutes.

Integration into service offerings

Would you considering including it in your IT services offering?

Web-based interface workflow for ‘create, download,

apply, join’

Your thoughts?

Active Directory Technologies

AD Domain Services AD DS AD AD Rights Lightweight Management Directory Services Services AD RMS
AD Domain
Services
AD DS
AD
AD Rights
Lightweight
Management
Directory
Services
Services
AD RMS
AD LDS
AD Certificate
Services
AD Federation
Services
AD CS
AD FS

Resources

Active Directory Recycle bin Step-By-Step:

Offline Domain Join Step-By-Step:

Active Directory technologies:

Thank You!